CCI-001358

Establish privileged user accounts in accordance with a role-based access scheme; or an attribute-based access scheme.

Implementation Guidance

Determine if privileged user accounts are established and administered in accordance with [AC-02(07)_ODP; one of the following PARAMETER VALUES is selected: {a role-based access scheme; an attribute-based access scheme}].

Validation Procedures

Examine: [SELECT FROM: Access control policy; procedures addressing account management; system design documentation; system configuration settings and associated documentation; system-generated list of privileged user accounts and associated roles; records of actions taken when privileged role assignments are no longer appropriate; system audit records; audit tracking and monitoring reports; system monitoring records; system security plan; other relevant documents or records]. Interview: [SELECT FROM: Organizational personnel with account management responsibilities; system/network administrators; organizational personnel with information security responsibilities]. Test: [SELECT FROM: Mechanisms implementing account management functions; mechanisms monitoring privileged role assignments].

The controls below (if any) were marked by NIST as being related to CCI-001358.